@blindmarket/sdk 0.1.7 → 0.1.8

package/dist/KeyStore-Be_SSpCt.d.cts

@@ -1,21 +0,0 @@
-import { T as TaskId, a as TaskKey, A as Address, H as Hex, c as TaskKeyRef } from './types-BOG5Ub1z.cjs';
-
-/**
- * Per-session storage for task AES keys and cached peer public keys. The SDK
- * never logs or serializes anything from here — this is the one place at-rest
- * secrets live. Implementations MUST treat passphrase-protected exports as the
- * only portable format.
- */
-interface KeyStore {
-    putTaskKey(taskId: TaskId, key: TaskKey): Promise<void>;
-    getTaskKey(taskId: TaskId): Promise<TaskKey | null>;
-    putPeerPubKey(addr: Address, pubkey: Hex): Promise<void>;
-    getPeerPubKey(addr: Address): Promise<Hex | null>;
-    list(): Promise<TaskKeyRef[]>;
-    delete(taskId: TaskId): Promise<void>;
-    /** Portable, encrypted-at-rest JSON export for backup/migration. */
-    export(passphrase: string): Promise<string>;
-    import(data: string, passphrase: string): Promise<void>;
-}
-
-export type { KeyStore as K };

package/dist/KeyStore-k1JgYPJY.d.ts

@@ -1,21 +0,0 @@
-import { T as TaskId, a as TaskKey, A as Address, H as Hex, c as TaskKeyRef } from './types-BOG5Ub1z.js';
-
-/**
- * Per-session storage for task AES keys and cached peer public keys. The SDK
- * never logs or serializes anything from here — this is the one place at-rest
- * secrets live. Implementations MUST treat passphrase-protected exports as the
- * only portable format.
- */
-interface KeyStore {
-    putTaskKey(taskId: TaskId, key: TaskKey): Promise<void>;
-    getTaskKey(taskId: TaskId): Promise<TaskKey | null>;
-    putPeerPubKey(addr: Address, pubkey: Hex): Promise<void>;
-    getPeerPubKey(addr: Address): Promise<Hex | null>;
-    list(): Promise<TaskKeyRef[]>;
-    delete(taskId: TaskId): Promise<void>;
-    /** Portable, encrypted-at-rest JSON export for backup/migration. */
-    export(passphrase: string): Promise<string>;
-    import(data: string, passphrase: string): Promise<void>;
-}
-
-export type { KeyStore as K };

package/dist/Signer-BnqH_qew.d.cts

@@ -1,38 +0,0 @@
-import { A as Address, H as Hex } from './types-BOG5Ub1z.cjs';
-
-interface TxRequest {
-    to: Address;
-    from?: Address;
-    data?: Hex;
-    value?: bigint;
-    gasLimit?: bigint;
-    nonce?: number;
-    chainId?: bigint;
-}
-interface TypedDataDomain {
-    name?: string;
-    version?: string;
-    chainId?: bigint | number;
-    verifyingContract?: Address;
-    salt?: Hex;
-}
-type TypedDataField = {
-    name: string;
-    type: string;
-};
-/**
- * Uniform signing interface used across the SDK. Adapters wrap ethers Signer,
- * raw private keys, EIP-1193 providers, or KMS. Implementations MUST return
- * hex-encoded signatures (0x-prefixed) and addresses (0x-prefixed, 20 bytes).
- */
-interface Signer {
-    getAddress(): Promise<Address>;
-    chainId(): Promise<bigint>;
-    signMessage(msg: string | Uint8Array): Promise<Hex>;
-    signTypedData(domain: TypedDataDomain, types: Record<string, TypedDataField[]>, value: Record<string, unknown>): Promise<Hex>;
-    signTransaction(tx: TxRequest): Promise<Hex>;
-    /** Uncompressed secp256k1 public key, 0x04-prefixed (hex). */
-    getPublicKey(): Promise<Hex>;
-}
-
-export type { Signer as S, TypedDataDomain as T, TypedDataField as a, TxRequest as b };

package/dist/Signer-LColE0Uo.d.ts

@@ -1,38 +0,0 @@
-import { A as Address, H as Hex } from './types-BOG5Ub1z.js';
-
-interface TxRequest {
-    to: Address;
-    from?: Address;
-    data?: Hex;
-    value?: bigint;
-    gasLimit?: bigint;
-    nonce?: number;
-    chainId?: bigint;
-}
-interface TypedDataDomain {
-    name?: string;
-    version?: string;
-    chainId?: bigint | number;
-    verifyingContract?: Address;
-    salt?: Hex;
-}
-type TypedDataField = {
-    name: string;
-    type: string;
-};
-/**
- * Uniform signing interface used across the SDK. Adapters wrap ethers Signer,
- * raw private keys, EIP-1193 providers, or KMS. Implementations MUST return
- * hex-encoded signatures (0x-prefixed) and addresses (0x-prefixed, 20 bytes).
- */
-interface Signer {
-    getAddress(): Promise<Address>;
-    chainId(): Promise<bigint>;
-    signMessage(msg: string | Uint8Array): Promise<Hex>;
-    signTypedData(domain: TypedDataDomain, types: Record<string, TypedDataField[]>, value: Record<string, unknown>): Promise<Hex>;
-    signTransaction(tx: TxRequest): Promise<Hex>;
-    /** Uncompressed secp256k1 public key, 0x04-prefixed (hex). */
-    getPublicKey(): Promise<Hex>;
-}
-
-export type { Signer as S, TypedDataDomain as T, TypedDataField as a, TxRequest as b };

package/dist/Storage-4QOrh7rm.d.ts

@@ -1,17 +0,0 @@
-import { U as UploadResult, d as RootHash } from './types-BOG5Ub1z.js';
-
-/**
- * Abstraction over blob storage. Default implementation (ZgStorage) uses
- * 0G Storage; MemoryStorage is for tests and local fallback. Consumers can
- * provide their own adapter for IPFS, S3, etc.
- */
-interface Storage {
-    /** Upload bytes, return root hash + optional tx hash + size. */
-    upload(bytes: Uint8Array): Promise<UploadResult>;
-    /** Download bytes by root hash. Throws StorageError('STORAGE/NOT_FOUND') if absent. */
-    download(rootHash: RootHash): Promise<Uint8Array>;
-    /** Compute the canonical root hash without uploading. */
-    hash(bytes: Uint8Array): Promise<RootHash>;
-}
-
-export type { Storage as S };

package/dist/Storage-Cf4IJRMk.d.cts

@@ -1,17 +0,0 @@
-import { U as UploadResult, d as RootHash } from './types-BOG5Ub1z.cjs';
-
-/**
- * Abstraction over blob storage. Default implementation (ZgStorage) uses
- * 0G Storage; MemoryStorage is for tests and local fallback. Consumers can
- * provide their own adapter for IPFS, S3, etc.
- */
-interface Storage {
-    /** Upload bytes, return root hash + optional tx hash + size. */
-    upload(bytes: Uint8Array): Promise<UploadResult>;
-    /** Download bytes by root hash. Throws StorageError('STORAGE/NOT_FOUND') if absent. */
-    download(rootHash: RootHash): Promise<Uint8Array>;
-    /** Compute the canonical root hash without uploading. */
-    hash(bytes: Uint8Array): Promise<RootHash>;
-}
-
-export type { Storage as S };

package/dist/TaskRegistryClient-Ch6lYqM_.d.ts

@@ -1,24 +0,0 @@
-import { ethers } from 'ethers';
-import { A as Address, T as TaskId, b as TxReceiptLike } from './types-BOG5Ub1z.js';
-
-interface OpenTaskMeta {
-    taskId: TaskId;
-    token: Address;
-    category: string;
-    locationZone: string;
-    reward: bigint;
-    createdAt: Date;
-}
-declare class TaskRegistryClient {
-    readonly contract: ethers.Contract;
-    readonly address: Address;
-    constructor(address: Address, runner: ethers.ContractRunner);
-    getTaskMeta(taskId: TaskId): Promise<OpenTaskMeta>;
-    getOpenTasks(offset: bigint, limit: bigint): Promise<TaskId[]>;
-    totalTasks(): Promise<bigint>;
-    openTaskCount(): Promise<bigint>;
-    taskExists(taskId: TaskId): Promise<boolean>;
-    closeTask(taskId: TaskId): Promise<TxReceiptLike>;
-}
-
-export { type OpenTaskMeta as O, TaskRegistryClient as T };

package/dist/TaskRegistryClient-CrQjddDc.d.cts

@@ -1,24 +0,0 @@
-import { ethers } from 'ethers';
-import { A as Address, T as TaskId, b as TxReceiptLike } from './types-BOG5Ub1z.cjs';
-
-interface OpenTaskMeta {
-    taskId: TaskId;
-    token: Address;
-    category: string;
-    locationZone: string;
-    reward: bigint;
-    createdAt: Date;
-}
-declare class TaskRegistryClient {
-    readonly contract: ethers.Contract;
-    readonly address: Address;
-    constructor(address: Address, runner: ethers.ContractRunner);
-    getTaskMeta(taskId: TaskId): Promise<OpenTaskMeta>;
-    getOpenTasks(offset: bigint, limit: bigint): Promise<TaskId[]>;
-    totalTasks(): Promise<bigint>;
-    openTaskCount(): Promise<bigint>;
-    taskExists(taskId: TaskId): Promise<boolean>;
-    closeTask(taskId: TaskId): Promise<TxReceiptLike>;
-}
-
-export { type OpenTaskMeta as O, TaskRegistryClient as T };

package/dist/aes-J-7HrHze.d.cts

@@ -1,17 +0,0 @@
-/** Generate a fresh 32-byte AES-256 key. */
-declare function generateAesKey(): Promise<Uint8Array>;
-/**
- * AES-256-GCM encrypt. Output format: [12 IV][16 tag][ciphertext].
- * This ordering matches backend/src/services/crypto.ts and frontend/src/lib/crypto.ts
- * byte-for-byte, so SDK blobs decrypt anywhere in the stack.
- */
-declare function aesEncrypt(plaintext: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
-/**
- * AES-256-GCM decrypt. Input format: [12 IV][16 tag][ciphertext].
- * Throws CRYPTO/INTEGRITY_CHECK on truncation or tag mismatch.
- */
-declare function aesDecrypt(blob: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
-/** SHA-256 of arbitrary bytes. Returns 32-byte digest. */
-declare function sha256(data: Uint8Array): Promise<Uint8Array>;
-
-export { aesDecrypt as a, aesEncrypt as b, generateAesKey as g, sha256 as s };

package/dist/aes-J-7HrHze.d.ts

@@ -1,17 +0,0 @@
-/** Generate a fresh 32-byte AES-256 key. */
-declare function generateAesKey(): Promise<Uint8Array>;
-/**
- * AES-256-GCM encrypt. Output format: [12 IV][16 tag][ciphertext].
- * This ordering matches backend/src/services/crypto.ts and frontend/src/lib/crypto.ts
- * byte-for-byte, so SDK blobs decrypt anywhere in the stack.
- */
-declare function aesEncrypt(plaintext: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
-/**
- * AES-256-GCM decrypt. Input format: [12 IV][16 tag][ciphertext].
- * Throws CRYPTO/INTEGRITY_CHECK on truncation or tag mismatch.
- */
-declare function aesDecrypt(blob: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
-/** SHA-256 of arbitrary bytes. Returns 32-byte digest. */
-declare function sha256(data: Uint8Array): Promise<Uint8Array>;
-
-export { aesDecrypt as a, aesEncrypt as b, generateAesKey as g, sha256 as s };

package/dist/agent/index.cjs

@@ -1,425 +0,0 @@
-'use strict';
-
-var ethers = require('ethers');
-
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
-// src/crypto/constants.ts
-var IV_LENGTH, TAG_LENGTH, KEY_LENGTH, ECIES_PUBKEY_LENGTH, ECIES_HKDF_INFO, AES_MIN_BLOB, ECIES_MIN_BLOB;
-var init_constants = __esm({
-  "src/crypto/constants.ts"() {
-    IV_LENGTH = 12;
-    TAG_LENGTH = 16;
-    KEY_LENGTH = 32;
-    ECIES_PUBKEY_LENGTH = 65;
-    ECIES_HKDF_INFO = new TextEncoder().encode("BlindBounty-ECIES-v1");
-    AES_MIN_BLOB = IV_LENGTH + TAG_LENGTH;
-    ECIES_MIN_BLOB = ECIES_PUBKEY_LENGTH + AES_MIN_BLOB;
-  }
-});
-
-// src/errors/codes.ts
-var init_codes = __esm({
-  "src/errors/codes.ts"() {
-  }
-});
-
-// src/errors/BlindBountyError.ts
-var BlindBountyError;
-var init_BlindBountyError = __esm({
-  "src/errors/BlindBountyError.ts"() {
-    BlindBountyError = class extends Error {
-      code;
-      retriable;
-      context;
-      cause;
-      constructor(code, message, opts = {}) {
-        super(message);
-        this.code = code;
-        this.retriable = opts.retriable ?? false;
-        if (opts.context !== void 0) this.context = opts.context;
-        if (opts.cause !== void 0) this.cause = opts.cause;
-        Object.defineProperty(this, "name", {
-          value: this.constructor.name,
-          enumerable: false,
-          configurable: true,
-          writable: true
-        });
-      }
-      toJSON() {
-        return {
-          name: this.name,
-          code: this.code,
-          message: this.message,
-          retriable: this.retriable,
-          ...this.context ? { context: this.context } : {}
-        };
-      }
-    };
-  }
-});
-
-// src/errors/subclasses.ts
-var CryptoError, LifecycleError;
-var init_subclasses = __esm({
-  "src/errors/subclasses.ts"() {
-    init_BlindBountyError();
-    CryptoError = class extends BlindBountyError {
-      constructor(code, msg, opts) {
-        super(code, msg, opts);
-      }
-    };
-    LifecycleError = class extends BlindBountyError {
-      constructor(code, msg, opts) {
-        super(code, msg, opts);
-      }
-    };
-  }
-});
-
-// src/errors/index.ts
-var init_errors = __esm({
-  "src/errors/index.ts"() {
-    init_codes();
-    init_BlindBountyError();
-    init_subclasses();
-  }
-});
-
-// src/crypto/aes.ts
-function getCrypto() {
-  const c = globalThis.crypto;
-  if (!c?.subtle) {
-    throw new CryptoError("CRYPTO/UNSUPPORTED_CIPHER", "Web Crypto (crypto.subtle) is not available");
-  }
-  return c;
-}
-function toArrayBuffer(u) {
-  const ab = new ArrayBuffer(u.byteLength);
-  new Uint8Array(ab).set(u);
-  return ab;
-}
-async function generateAesKey() {
-  const key = new Uint8Array(KEY_LENGTH);
-  getCrypto().getRandomValues(key);
-  return key;
-}
-async function aesEncrypt(plaintext, key) {
-  if (key.byteLength !== KEY_LENGTH) {
-    throw new CryptoError(
-      "CRYPTO/INVALID_KEY",
-      `AES key must be ${KEY_LENGTH} bytes, got ${key.byteLength}`
-    );
-  }
-  const c = getCrypto();
-  const iv = new Uint8Array(IV_LENGTH);
-  c.getRandomValues(iv);
-  try {
-    const ck = await c.subtle.importKey("raw", toArrayBuffer(key), "AES-GCM", false, ["encrypt"]);
-    const wcOut = new Uint8Array(
-      await c.subtle.encrypt(
-        { name: "AES-GCM", iv: toArrayBuffer(iv), tagLength: TAG_LENGTH * 8 },
-        ck,
-        toArrayBuffer(plaintext)
-      )
-    );
-    const ctLen = wcOut.length - TAG_LENGTH;
-    const ct = wcOut.subarray(0, ctLen);
-    const tag = wcOut.subarray(ctLen);
-    const blob = new Uint8Array(IV_LENGTH + TAG_LENGTH + ctLen);
-    blob.set(iv, 0);
-    blob.set(tag, IV_LENGTH);
-    blob.set(ct, IV_LENGTH + TAG_LENGTH);
-    return blob;
-  } catch (cause) {
-    throw new CryptoError("CRYPTO/DECRYPT_FAILED", "AES-GCM encryption failed", { cause });
-  }
-}
-async function aesDecrypt(blob, key) {
-  if (key.byteLength !== KEY_LENGTH) {
-    throw new CryptoError(
-      "CRYPTO/INVALID_KEY",
-      `AES key must be ${KEY_LENGTH} bytes, got ${key.byteLength}`
-    );
-  }
-  if (blob.byteLength < AES_MIN_BLOB) {
-    throw new CryptoError(
-      "CRYPTO/INTEGRITY_CHECK",
-      `AES blob too short: need \u2265${AES_MIN_BLOB} bytes, got ${blob.byteLength}`
-    );
-  }
-  const iv = blob.subarray(0, IV_LENGTH);
-  const tag = blob.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH);
-  const ct = blob.subarray(IV_LENGTH + TAG_LENGTH);
-  const combined = new Uint8Array(ct.length + TAG_LENGTH);
-  combined.set(ct, 0);
-  combined.set(tag, ct.length);
-  try {
-    const c = getCrypto();
-    const ck = await c.subtle.importKey("raw", toArrayBuffer(key), "AES-GCM", false, ["decrypt"]);
-    const pt = await c.subtle.decrypt(
-      { name: "AES-GCM", iv: toArrayBuffer(iv), tagLength: TAG_LENGTH * 8 },
-      ck,
-      toArrayBuffer(combined)
-    );
-    return new Uint8Array(pt);
-  } catch (cause) {
-    throw new CryptoError("CRYPTO/DECRYPT_FAILED", "AES-GCM decryption failed (wrong key or tampered data)", { cause });
-  }
-}
-var init_aes = __esm({
-  "src/crypto/aes.ts"() {
-    init_errors();
-    init_constants();
-  }
-});
-
-// src/crypto/hkdf.ts
-function getSubtle() {
-  const c = globalThis.crypto;
-  if (!c?.subtle) {
-    throw new CryptoError("CRYPTO/UNSUPPORTED_CIPHER", "Web Crypto (crypto.subtle) is not available");
-  }
-  return c.subtle;
-}
-function toArrayBuffer2(u) {
-  const ab = new ArrayBuffer(u.byteLength);
-  new Uint8Array(ab).set(u);
-  return ab;
-}
-async function hkdfSha256(ikm, length = 32, info = ECIES_HKDF_INFO, salt = new Uint8Array(0)) {
-  try {
-    const subtle = getSubtle();
-    const baseKey = await subtle.importKey("raw", toArrayBuffer2(ikm), "HKDF", false, ["deriveBits"]);
-    const derived = await subtle.deriveBits(
-      {
-        name: "HKDF",
-        hash: "SHA-256",
-        info: toArrayBuffer2(info),
-        salt: toArrayBuffer2(salt)
-      },
-      baseKey,
-      length * 8
-    );
-    return new Uint8Array(derived);
-  } catch (cause) {
-    throw new CryptoError("CRYPTO/INVALID_KEY", "HKDF derivation failed", { cause });
-  }
-}
-var init_hkdf = __esm({
-  "src/crypto/hkdf.ts"() {
-    init_errors();
-    init_constants();
-  }
-});
-function strip(hex) {
-  return hex.startsWith("0x") || hex.startsWith("0X") ? hex.slice(2) : hex;
-}
-function assertUncompressedPubKey(pub) {
-  const s = strip(pub);
-  if (s.length !== 130 || !/^04/i.test(s)) {
-    throw new CryptoError(
-      "CRYPTO/INVALID_KEY",
-      "expected uncompressed secp256k1 pubkey (65 bytes hex, starts with 04)"
-    );
-  }
-}
-function hexToBytes(hex) {
-  const s = strip(hex);
-  if (s.length % 2 !== 0) {
-    throw new CryptoError("CRYPTO/INVALID_KEY", "hex string has odd length");
-  }
-  const out = new Uint8Array(s.length / 2);
-  for (let i = 0; i < out.length; i++) {
-    const byte = Number.parseInt(s.substring(i * 2, i * 2 + 2), 16);
-    if (Number.isNaN(byte)) {
-      throw new CryptoError("CRYPTO/INVALID_KEY", `invalid hex byte at position ${i * 2}`);
-    }
-    out[i] = byte;
-  }
-  return out;
-}
-function bytesToHex(u) {
-  return Array.from(u, (b) => b.toString(16).padStart(2, "0")).join("");
-}
-var init_keys = __esm({
-  "src/crypto/keys.ts"() {
-    init_errors();
-  }
-});
-
-// src/crypto/ecies.ts
-var ecies_exports = {};
-__export(ecies_exports, {
-  eciesDecrypt: () => eciesDecrypt,
-  eciesEncrypt: () => eciesEncrypt
-});
-async function eciesEncrypt(plaintext, recipientPubKey) {
-  assertUncompressedPubKey(recipientPubKey);
-  const ephemeral = ethers.ethers.Wallet.createRandom();
-  const shared = deriveSharedSecretX(ephemeral.privateKey, `0x${strip(recipientPubKey)}`);
-  const aesKey = await hkdfSha256(shared, KEY_LENGTH);
-  const aesBlob = await aesEncrypt(plaintext, aesKey);
-  const ephPub = hexToBytes(strip(ephemeral.signingKey.publicKey));
-  if (ephPub.byteLength !== ECIES_PUBKEY_LENGTH) {
-    throw new CryptoError("CRYPTO/INVALID_KEY", `ephemeral pubkey length ${ephPub.byteLength}`);
-  }
-  const blob = new Uint8Array(ECIES_PUBKEY_LENGTH + aesBlob.byteLength);
-  blob.set(ephPub, 0);
-  blob.set(aesBlob, ECIES_PUBKEY_LENGTH);
-  return blob;
-}
-async function eciesDecrypt(blob, recipientPrivKey) {
-  if (blob.byteLength < ECIES_MIN_BLOB) {
-    throw new CryptoError(
-      "CRYPTO/INTEGRITY_CHECK",
-      `ECIES blob too short: need \u2265${ECIES_MIN_BLOB} bytes, got ${blob.byteLength}`
-    );
-  }
-  const ephPub = blob.subarray(0, ECIES_PUBKEY_LENGTH);
-  const aesBlob = blob.subarray(ECIES_PUBKEY_LENGTH);
-  const shared = deriveSharedSecretX(`0x${strip(recipientPrivKey)}`, `0x${bytesToHex(ephPub)}`);
-  const aesKey = await hkdfSha256(shared, KEY_LENGTH);
-  return aesDecrypt(aesBlob, aesKey);
-}
-function deriveSharedSecretX(privHex, pubHex) {
-  const sk = new ethers.ethers.SigningKey(privHex);
-  const shared = sk.computeSharedSecret(pubHex);
-  const bytes = hexToBytes(strip(shared));
-  if (bytes.byteLength !== 65 || bytes[0] !== 4) {
-    throw new CryptoError(
-      "CRYPTO/INVALID_KEY",
-      `unexpected shared secret shape (len=${bytes.byteLength}, prefix=${bytes[0]?.toString(16) ?? "none"})`
-    );
-  }
-  return bytes.subarray(1, 33);
-}
-var init_ecies = __esm({
-  "src/crypto/ecies.ts"() {
-    init_errors();
-    init_aes();
-    init_constants();
-    init_hkdf();
-    init_keys();
-  }
-});
-
-// src/crypto/envelope.ts
-init_errors();
-init_aes();
-var MAGIC_0 = 66;
-var MAGIC_1 = 66;
-var VERSION = 1;
-var HEADER_LEN = 3;
-async function openEvidenceAsAgent(envelope, agentPrivKey) {
-  const parsed = parse(envelope);
-  const { eciesDecrypt: eciesDecrypt2 } = await Promise.resolve().then(() => (init_ecies(), ecies_exports));
-  const aesKey = await eciesDecrypt2(parsed.wrappedForAgent, agentPrivKey);
-  return aesDecrypt(parsed.aesCiphertext, aesKey);
-}
-function parse(blob) {
-  if (blob.byteLength < HEADER_LEN + 4 + 4) {
-    throw new CryptoError("CRYPTO/INTEGRITY_CHECK", `envelope too short: ${blob.byteLength}`);
-  }
-  if (blob[0] !== MAGIC_0 || blob[1] !== MAGIC_1) {
-    throw new CryptoError("CRYPTO/INTEGRITY_CHECK", "bad envelope magic");
-  }
-  if (blob[2] !== VERSION) {
-    throw new CryptoError("CRYPTO/UNSUPPORTED_CIPHER", `unknown envelope version ${blob[2]}`);
-  }
-  const view = new DataView(blob.buffer, blob.byteOffset, blob.byteLength);
-  let off = HEADER_LEN;
-  const agentLen = view.getUint32(off, false);
-  off += 4;
-  if (off + agentLen + 4 > blob.byteLength) {
-    throw new CryptoError("CRYPTO/INTEGRITY_CHECK", "envelope truncated (agent)");
-  }
-  const wrappedForAgent = blob.slice(off, off + agentLen);
-  off += agentLen;
-  const enclaveLen = view.getUint32(off, false);
-  off += 4;
-  if (off + enclaveLen > blob.byteLength) {
-    throw new CryptoError("CRYPTO/INTEGRITY_CHECK", "envelope truncated (enclave)");
-  }
-  const wrappedForEnclave = blob.slice(off, off + enclaveLen);
-  off += enclaveLen;
-  const aesCiphertext = blob.slice(off);
-  return { wrappedForAgent, wrappedForEnclave, aesCiphertext };
-}
-
-// src/agent/Agent.ts
-init_errors();
-var Agent = class {
-  constructor(deps) {
-    this.deps = deps;
-  }
-  deps;
-  async createTask(input) {
-    const { storage, escrow, keystore, events } = this.deps;
-    const aesKey = await generateAesKey();
-    const plaintext = toBytes(input.instructions);
-    const ciphertext = await aesEncrypt(plaintext, aesKey);
-    const uploaded = await storage.upload(ciphertext);
-    const rootHash = uploaded.rootHash;
-    const deadline = typeof input.deadline === "bigint" ? input.deadline : BigInt(Math.floor(input.deadline.getTime() / 1e3));
-    const { taskId, receipt } = await escrow.createTask({
-      taskHash: rootHash,
-      token: input.reward.token,
-      amount: input.reward.amount,
-      category: input.category,
-      locationZone: input.locationZone,
-      deadline
-    });
-    const taskKey = { aesKey, createdAt: /* @__PURE__ */ new Date() };
-    await keystore.putTaskKey(taskId, taskKey);
-    events?.emit("task.created", { taskId, txHash: receipt.hash, rootHash });
-    return { taskId, taskKey, rootHash, txHash: receipt.hash, receipt };
-  }
-  /**
-   * Wrap the stored AES key for the chosen worker and record the assignment
-   * on-chain. The caller must deliver `wrappedKey` to the worker separately
-   * (backend API, DM, etc.). Returns the wrapped bytes and the tx receipt.
-   */
-  async assignWorker(taskId, worker, workerPubKey) {
-    const { keystore, escrow, events } = this.deps;
-    const stored = await keystore.getTaskKey(taskId);
-    if (!stored) {
-      throw new LifecycleError("LIFECYCLE/TASK_NOT_FOUND", `no task key in keystore for task ${taskId}`);
-    }
-    const wrappedKey = await eciesEncrypt(stored.aesKey, workerPubKey);
-    const receipt = await escrow.assignWorker(taskId, worker);
-    events?.emit("task.assigned", { taskId, worker, txHash: receipt.hash });
-    return { wrappedKey, receipt };
-  }
-  async cancelTask(taskId) {
-    const { escrow, keystore, events } = this.deps;
-    const receipt = await this.deps.escrow.cancelTask(taskId);
-    await keystore.delete(taskId);
-    events?.emit("task.cancelled", { taskId, txHash: receipt.hash });
-    return receipt;
-  }
-  /**
-   * Fetch evidence by root hash, unwrap the AES key with the agent's private
-   * key (signer's key material is not accessible, so a raw private key is
-   * required), and return the decrypted evidence plaintext.
-   */
-  async fetchAndDecryptEvidence(evidenceHash, agentPrivKey) {
-    const envelope = await this.deps.storage.download(evidenceHash);
-    return openEvidenceAsAgent(envelope, agentPrivKey);
-  }
-};
-function toBytes(x) {
-  return typeof x === "string" ? new TextEncoder().encode(x) : x;
-}
-
-exports.Agent = Agent;
-//# sourceMappingURL=index.cjs.map
-//# sourceMappingURL=index.cjs.map